public_key:pkix_path_validation fails validation of certs expiring later than 2050

[andreasanta]

Describe the bug
When a certificate contains a notAfter attribute with utcTime and 69 as year, the current implementation interprets 69 as 1969 and thus fails validation.

To Reproduce

public_key:pkix_path_validation(
   base64:decode(
<<"MIIB8jCCAXmgAwIBAgIQJK7xvc/d7ftI/3ItJKDnATAKBggqhkjOPQQDAjA5MQwwCgYDVQQMDANURUUxKTAnBgNVBAUTIDMwMGNmYWMwYWZjNzVlYjM1OTU5YWYwOTRlYzg3ZTkzMB4XDTIxMDExMzIwNTUzN1oXDTMxMDExMTIwNTUzN1owOTEMMAoGA1UEDAwDVEVFMSkwJwYDVQQFEyBhYzkyMDUxMmE0OGJjYmI4MmExMzJiODI0MGMzMGY3ZjBZMBMGByqGSM49AgEGCCqGSM49AwEHA0IABACWY0wWoGe6ZEhNH44bU3wdDzyzgpQYcI63vQQNZJQA77SNW/RLPpZY0/v9si0x0Fj3jVTI7T4vXmTHWHz5S2+jYzBhMB0GA1UdDgQWBBT8S00goQucA/MSK8z/otKDRGLXLTAfBgNVHSMEGDAWgBSF5719t7pZSOmQAu5T/SYhsaYRozAPBgNVHRMBAf8EBTADAQH/MA4GA1UdDwEB/wQEAwICBDAKBggqhkjOPQQDAgNnADBkAjB41XYKh9vPV0+TGReEdazolyVtHGLxbn4nCpCEnhQ5KFaqpmfLZu78SdLH4YCwET0CMCxqkX2WJ7nq9OQ+EUB1Tm/rOQxU+Ncc9m1bO3ljHTEVrn3SPdhm7QOpaEg+zgRznA==">>),
   [base64:decode(
<<"MIICijCCAjCgAwIBAgIBATAKBggqhkjOPQQDAjA5MQwwCgYDVQQMDANURUUxKTAnBgNVBAUTIGFjOTIwNTEyYTQ4YmNiYjgyYTEzMmI4MjQwYzMwZjdmMB4XDTcwMDEwMTAwMDAwMFoXDTY5MTIzMTIzNTk1OVowHzEdMBsGA1UEAwwUQW5kcm9pZCBLZXlzdG9yZSBLZXkwWTATBgcqhkjOPQIBBggqhkjOPQMBBwNCAAQpU+wq5kskHQlVw9G99ZaBc5W10UBSHaPsZUKqv0bFeEgxoTedp4UwQnYQF8UBTHHTX1Jrj67SPS9/aZGN4/bUo4IBQTCCAT0wDgYDVR0PAQH/BAQDAgeAMIIBKQYKKwYBBAHWeQIBEQSCARkwggEVAgEDCgEBAgEECgEBBCAOvA1gDJ7gK+NmuvB1bnnmVXF5tkah8Kst9H5V2QElLAQAMFC/hT0IAgYBhBBomCi/hUVABD4wPDEWMBQEDGNvbS53aGF0c2FwcAIEDUA2RDEiBCA5h9BD0Qrvr1qHELNnFBj+V+Dhm2U8nfglWP61/85dRDCBkKEFMQMCAQKiAwIBA6MEAgIBAKUIMQYCAQQCAQaqAwIBAb+DdwIFAL+FPgMCAQC/hUBMMEoEIL6unE424R3wU24e9wDk/sO7HAzEtYDyKx6J0Kb0B1GwAQH/CgEABCBX83onOiYL+Ly+AYx+cJR2jBI6wHIWgSyVMrhl6EH4Yr+FQQUCAwGtsL+FQgUCAwMV3zAKBggqhkjOPQQDAgNIADBFAiEAwH0/6EKJ+yySQInM6OyzOGEuLDUbifJe7n41VSG55sACID7UxW08BNmH8Fr2f7rhcgczI+mcdYIMTUQlVMoHxw2Y">>
   )], 
   []
).

Will yield
{error,{bad_cert,cert_expired}}

Expected behavior
Certificate validation should succeed, and the 69 component of the certificate attribute notAfter should be interpreted as 2069 instead of 1969.

Affected versions
Erlang/OTP 25 [erts-13.0.2]

Additional context
This is due to the implementation of validate_time inside public_key.erl. The implementation uses the simple method instead of the rolling window method reported in https://www.oss.com/asn1/resources/books-whitepapers-pubs/larmouth-asn1-book.pdf
(page 91).

[IngelaAndin]

I agree that we should change the implementation to use rolling window method.

[IngelaAndin]

Although the sliding window expects that you have no older certs than 50 years back, this seems not to be working out for your example.

validity =
#'Validity'{
notBefore = {utcTime,"700101000000Z"},
notAfter = {utcTime,"691231235959Z"}}.

So we get NotBefore: 2070, NotAfter: 2069. But I guess you wanted NotBefore: 1970, NotAfter:2069.

[IngelaAndin]

The best of course is to make new certs adhere to the new date-format so that we do not have to guess!

[kikofernandez]

Closed by PR #6542